DBS-C01 Database Security Practice Question
A financial services company runs a critical application on Amazon RDS for PostgreSQL. They must ensure that database activity logs are sent to Amazon CloudWatch Logs for real-time monitoring. The logs must include all SQL queries, including SELECT statements. Which configuration will meet these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set log_statement = 'all' and log_min_duration_statement = 0 in the DB parameter group. Enable CloudWatch Logs export.
Setting `log_statement = 'all'` captures every SQL statement, including SELECT, and `log_min_duration_statement = 0` ensures all statements are logged regardless of duration. Enabling CloudWatch Logs export then sends these logs to CloudWatch Logs for real-time monitoring. Option B is incorrect because while pgAudit can log all statements, it is not necessary; the built-in PostgreSQL logging with `log_statement = 'all'` meets the requirement without additional extensions. Option C is incorrect because `log_statement = 'ddl'` only logs data definition language statements, not SELECT queries. Option D is incorrect because `log_min_duration_statement = -1` disables logging of all statements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set log_statement = 'all' and log_min_duration_statement = 0 in the DB parameter group. Enable CloudWatch Logs export.
Why this is correct
log_statement = 'all' logs all statements, and log_min_duration_statement = 0 ensures all durations are logged, so all queries appear in the logs.
- ✗
Install the pgAudit extension and configure it to log all statements. Enable CloudWatch Logs export in the RDS console.
Why it's wrong here
The pgAudit extension writes its logs to a dedicated audit log stream, not the standard PostgreSQL error log. The RDS console’s generic CloudWatch Logs export only publishes the error log by default, so pgAudit entries are omitted unless the audit log export is explicitly enabled. This option is tempting because pgAudit is purpose-built for detailed statement logging, and it would be the correct choice in environments that require separate audit trails with selective filtering.
- ✗
Set the parameter log_statement = 'ddl' in the DB parameter group. Enable CloudWatch Logs export.
Why it's wrong here
log_statement = 'ddl' only logs DDL statements (CREATE, ALTER, DROP), not SELECT queries.
- ✗
Set log_min_duration_statement = -1 in the DB parameter group. Enable CloudWatch Logs export.
Why it's wrong here
A value of -1 disables logging of statement durations, but does not enable logging of all statements.
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.